CVE-2026-78058: CWE-400 Uncontrolled Resource Consumption in Apache Software Foundation Apache bRPC

Apache bRPC versions before 1.18.0 have multiple flaws in the HTTP/2 (h2) parser that lead to uncontrolled resource consumption. The server trusts peers to respect limits such as SETTINGS_MAX_CONCURRENT_STREAMS and SETTINGS_MAX_HEADER_LIST_SIZE but does not enforce them, allowing attackers to open an unbounded number of streams or send headers that expand massively in memory (HPACK bomb). Control-frame acknowledgments bypass socket write caps, enabling buffer growth under certain conditions. Additionally, a validation error in HPACK dynamic table size updates can cause decoder desynchronization and NULL pointer dereference crashes. These vulnerabilities affect any bRPC server or client communicating over HTTP/2/gRPC with untrusted networks, as the parser runs before authentication checks.

An attacker can remotely cause a denial of service by crashing the server or exhausting its memory resources, leading to service disruption. This can be triggered without authentication by sending specially crafted HTTP/2 frames. The vulnerability affects both servers and clients using bRPC with HTTP/2/gRPC protocols on untrusted networks.

A fix is available by upgrading Apache bRPC to version 1.18.0 or later. Alternatively, apply the patch referenced in the Apache bRPC GitHub pull request #3474. After applying the fix, the server enforces default limits such as max_concurrent_streams (1024 per connection) and max_header_list_size (1 MiB decoded per stream). Requests exceeding these limits are rejected, preventing resource exhaustion. Users should upgrade or patch promptly to mitigate this vulnerability.